PHP prevents CC attack code PHP prevents frequent refresh of web pages

This article mainly introduces the code of PHP to prevent CC attacks and PHP to prevent frequent refresh of web pages, rapid and malicious refresh of web pages. CC attacks use proxy servers to generate legitimate requests directed to the target site, simulating multiple users to continuously access the victim website. , interested friends can study

Rapid malicious refresh of web pages, cc attack is that the attacker uses the proxy server to generate legitimate requests directed to the target site, simulating multiple users to continuously access the victim website, especially Accessing pages that require a large amount of data operations and a large amount of CPU time will eventually lead to the target website server resources being exhausted until it crashes. In this way, server resources are wasted, and the CPU is at 100% for a long time, and there is always processing. Endless connections occur until the network is congested and normal access is terminated. We call it a CC attack. Although we can use some anti-attack software to achieve this, the effect is sometimes not obvious.

Below I provide a piece of PHP code that can prevent CC attacks to a certain extent.
Main functions: Continuously refreshing the page more than 5 times within 3 seconds will point to the local http://127.0.0.1
Just put this code on the page that needs to prevent CC attacks. Can.
Source code

<?php
$timestampcc = time();
$cc_nowtime = $timestampcc;
if(session_is_registered(&#39;cc_lasttime&#39;)){
 $cc_lasttime = $_SESSION[&#39;cc_lasttime&#39;];
 $cc_times = $_SESSION[&#39;cc_times&#39;]+1;
 $_SESSION[&#39;cc_times&#39;] = $cc_times;
}else{
 $cc_lasttime = $cc_nowtime;
 $cc_times = 1;
 $_SESSION[&#39;cc_times&#39;] = $cc_times;
 $_SESSION[&#39;cc_lasttime&#39;] = $cc_lasttime;
} 
if(($cc_nowtime-$cc_lasttime)<3){//3秒内刷新5次以上可能为cc攻击
 if($cc_times>=5){
 echo &#39;刷新太快!&#39;;
 exit;
 }
}else{
 $cc_times = 0;
 $_SESSION[&#39;cc_lasttime&#39;] = $cc_nowtime;
 $_SESSION[&#39;cc_times&#39;] = $cc_times;
} 
?>

The following is an effective method for preventing CC attacks in PHP for everyone:

1 .session record
submit.php is the sending page. Set a session variable on this page and send it to the submitdeal.php page as a hidden field and form. On the server side, the hidden variable posted from the post is sent to the server. Compare the session variables recorded on the end. For example, if they are the same, write to the database and clear the session. In this way, when the user refreshes the page, if the two values ​​are not equal, an error or jump will be prompted.
Advantages: No need for users to enter verification codes
Disadvantages: The form is easily copied
2 .Verification code
The principle is the same as the first one, except that the session data is not submitted as a hidden field, but is filled in by the user. Most websites use text verification codes and picture verification codes, and picture verification codes are highly secure. .

3.IP binding
After submitting the data, first retrieve the client IP from the IP table. If there is one and it has not expired, then an error will be reported, otherwise it will be written to the database, and then Then get the guest room IP and write the IP into the database.
4.cookie:After the client submits, the processing program first searches whether the client has set a cookie. If so, it will not submit again; if not, it will write the data and then write a cookie;
Example:

Users' meaningless frequent jumps and requests will put a lot of burden on the server. In fact, using cookies can prevent this.

<?php 
error_reporting(0); 
//if($_COOKIE["ck"])die("刷新过快！"); 
if($_COOKIE["ck"])header("Location:http://www.baidu.com");//这里如果用户刷新过快，给予终止php脚本或者直接302跳转 
setcookie("ck","1",time()+3);//设定cookie存活时间3s 
echo "hello!"; 
?>

Method one:

<?php  
session_start();  
$k=$_GET[&#39;k&#39;];  
$t=$_GET[&#39;t&#39;];  
$allowTime = 1800;//防刷新时间  
$ip = get_client_ip();  
$allowT = md5($ip.$k.$t);  
if(!isset($_SESSION[$allowT]))  
{  
 $refresh = true;  
 $_SESSION[$allowT] = time();  
}elseif(time() - $_SESSION[$allowT]>$allowTime){  
 $refresh = true;  
 $_SESSION[$allowT] = time();  
}else{  
 $refresh = false;  
}  
?>

Method two:

<? 
session_start(); 
if(!emptyempty($_POST[name])){ 
 $data = $_POST[name]; 
 $tag = $_POST[tag]; 
 if($_SESSION[status]==$tag){ 
 echo $data; 
 }else{ 
 echo "不允许刷新！"; 
 } 
} 
$v = mt_rand(1,10000); 
?> 
<form method="post" name="magic" action="f5.php"><input type="hidden" 
name="tag" value="<?=$v?>"><input type=text name="name"><input type="submit" value="submit"> 
</form> 
<? 
echo $v; 
$_SESSION[status] = $v; 
?>

Method three:

<? 
session_start(); 
if(!emptyempty($_POST[name])){ 
 $data = $_POST[name]; 
 $tag = $_POST[tag]; 
 if($_SESSION[status]==$tag){ 
 echo $data; 
 }else{ 
 echo "不允许刷新！"; 
 } 
} 
$v = mt_rand(1,10000); 
?> 
<form method="post" name="magic" action="f5.php"><input type="hidden" 
name="tag" value="<?=$v?>"><input type=text name="name"><input type="submit" value="submit"> 
</form> 
<? 
echo $v; 
$_SESSION[status] = $v; 
?>

The above is php There are many ways to prevent CC attacks. I hope it can help everyone prevent web pages from being refreshed quickly and maliciously.

Related recommendations:

ThinkPHP’s method to prevent repeated submission of forms

Explanation of PHP’s method to prevent sql injection

The above is the detailed content of PHP prevents CC attack code PHP prevents frequent refresh of web pages. For more information, please follow other related articles on the PHP Chinese website!